Personal Data Protection Law
in forceThe PDPL governs personal-data processing, rights, security, transfers and controller obligations relevant to AI training and deployment.
Jurisdiction baseline
AI regulation in Saudi Arabia.
Saudi Arabia does not have one comprehensive AI-specific act. Its framework combines the binding Personal Data Protection Law with the National Strategy for Data and AI, SDAIA's AI Ethics Principles, an AI Adoption Framework and sector regulation. The government designated 2026 as the Year of AI, expanding public programs, skills initiatives and institutional adoption.
Current baseline
Rules, policy and active programs
National Strategy for Data and AI
adopted strategyThe strategy sets national goals for skills, regulation, investment, research and AI adoption in priority sectors.
AI Ethics Principles
nonbinding principlesThe principles address fairness, privacy, safety, transparency, reliability, accountability and human values.
AI Adoption Framework
nonbinding frameworkThe framework provides organizations with a staged model for strategy, governance, data, technology, people and value realization.
Key questions
What the record shows
Is there an AI-specific law in force here?
No comprehensive AI act is in force. Binding obligations mainly arise from the Personal Data Protection Law and sector rules.
Who leads national AI policy?
The Saudi Data and Artificial Intelligence Authority leads the national data and AI agenda and publishes policy and governance frameworks.
Are the AI Ethics Principles binding law?
They are national governance principles rather than a comprehensive statute. Their practical importance can still be significant for public-sector and regulated deployments.
What is the significance of the 2026 Year of AI?
It is a national program for adoption, skills, public engagement and institutional initiatives. It does not itself create a comprehensive private-sector AI law.
Ask a question about Saudi Arabia
Get an answer grounded in this baseline and the wider Nomos catalogue.